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Intellectual Property Rights 



IPRs essential or potentially essential to the present document may have been declared to ETSI. The information 
pertaining to these essential IPRs, if any, is publicly available for ETSI members and non-members, and can be found 
in ETR 314: "Intellectual Property Rights (IPRs); Essential, or potentially Essential, IPRs notified to ETSI in respect of 
ETSI standards", which is available free of charge from the ETSI Secretariat. Latest updates are available on the ETSI 
Web server (http://www.etsi.fr/ipr). 

Pursuant to the ETSI Interim IPR Policy, no investigation, including IPR searches, has been carried out by ETSI. No 
guarantee can be given as to the existence of other IPRs not referenced in ETR 314 (or the updates on 
http://www.etsi.fr/ipr) which are, or may be, or may become, essential to the present document. 



Foreword 



This Global System for Mobile communications Technical Specification (GTS) has been produced by the Special 
Mobile Group (SMG) of the European Telecommunications Standards Institute (ETSI). 

This specification defines Fraud Information Gathering System (FIGS) Service description (Stage 1) within the digital 
cellular telecommunications system (Phase 2/Phase 2+). 
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1 Scope 



This GSM Technical Specification specifies the stage 1 description of the Fraud Information Gathering System (FIGS) 
feature which provides the means for the HPLMN to monitor the activities of its subscribers in a VPLMN. 

The purpose of this network feature is to enable the HPLMN to monitor the activities of its subscribers while they are 
roaming. The VPLMN collects information about a defined set of activities on monitored subscribers and sends this 
information back to the HPLMN. This enables the HPLMN to clear certain types of calls and so stop fraudulent use of 
the GSM system. 

This specification enables service providers/ network operators to use FIGS, and service limitation controls such as 
ODB and 1ST, to limit their financial exposure to subscribers producing large unpaid bills. 

HPLMNs may also choose to monitor the activities of its subscribers within the HPLMN. 



Normative references 



References may be made to: 

a) specific versions of publications (identified by date of publication, edition number, version number, etc.), in 
which case, subsequent revisions to the referenced document do not apply; or 

b) all versions up to and including the identified version (identified by "up to and including" before the version 
identity); or 

c) all versions subsequent to and including the identified version (identified by "onwards" following the version 
identity); or 

d) publications without mention of a specific version, in which case the latest version applies. 

A non-specific reference to an ETS shall also be taken to refer to later versions published as an EN with the same 
number. 

[1] GSM 0L04 (ETR 350): "Digital cellular telecommunications system (Phase 2+); Abbreviations 

and acronyms". 

[2] GSM 02.33: "Digital cellular telecommunications system (Phase 2); Lawful Interception - stage 1 



3 Definitions and abbreviations 

3.1 Definitions 

For the purposes of this specification the following definitions apply: 

A party number: the number of the mobile making a call for a mobile originated (MO) call and for a mobile terminated 
(MT) call, the number of the mobile receiving a call from the point of view of the switch serving the mobile. 

B party number: the number receiving a call for an MO call and, for an MT call, the number of the mobile making a 
call from the point of view of the switch serving the mobile. 

C party number: a number brought into a call either before the call is delivered (e.g. with call forwarding) or during the 
call (e.g. with explicit call transfer, or conference calls). 

call: both connection-oriented and connectionless services/events 

call information: information about a call 

call reference: a reference number for a call that shall remain constant throughout the duration of that call and that shall 
be unique to that call and the switch on which the call was made for a period of at least one week. 
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home network: The home PLMN including non-GSM elements such as the FDS, customer service systems and billing 

J-interface: The interface between the HPLMN and the VPLMN which is used to send FIGS data from the VPLMN to 
the HPLMN. 

K-interface: The interface between the HPLMN and the VPLMN that is used to send FIGS commands from the 
HPLMN to the VPLMN. 

monitored activities: subscriber activities that shall be reported to the HPLMN. These can be call related events (e.g. 
call-set-up, call termination) or the invocation of call related and call independent supplementary services (e.g. Call 
Hold, Call Waiting, Call Transfer, Call Forwarding, USSD) 

Y-interface: The interface between the HPLMN and the FDS. 

3.2 Abbreviations 

Abbreviations used in this specification are also listed in GSM 0L04. 

For the purposes of this specification the following abbreviations apply: 

FIGS Fraud Information Gathering System 

FDS Fraud Detection System 

1ST Immediate Service Termination 

MO Mobile Originated 

MT Mobile Terminated 

4 Fraud Information Gathering System high level 

requirements 



4.1 Description 



It shall be possible for the HPLMN to request the VPLMN to supply certain information about a subscriber from the 
time the subscriber registers in that VPLMN to the time the last of the monitored activities is finished in that VPLMN, 
which can be after the subscriber's de-registration from the VPLMN. The information received by the HPLMN shall be 
passed to the relevant network or service providers and used to instruct the VPLMN to act in an appropriate way. 

Fraud information gathering is controlled by the HPLMN and can be activated and deactivated by the HPLMN only. 

The information is received in the HPLMN via the J-interface and is forwarded across the Y-Interface to fraud detection 
and control systems. Such systems are out of the scope of this standard. 

The subscriber is specified by the IMSI or MSISDN. 

4.2 Applicability 

This network feature applies to all subscribed Bearer Services and Teleservices and supplementary services of the 
subscriber. It is not possible to apply FIGS independently to individual Services. 

The HPLMN shall be able to specify whether it would like call information on MO calls, MT calls, or both. 

Editor's note: An MT call does not necessarily involve a radio interface connection, for example, a forwarded call. 

4.3 Normal Procedure 

The HPLMN shall be able to request a VPLMN to monitor a subscriber 

This request shall include a category, indicating to the VPLMN the amount of information that should be sent back to 
the HPLMN for each FIGS event. The categories, and their meaning are as follows: 
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minimum call information; 

standard call information; 

detailed call information. 

See Annex A for the definition of the information to be sent for each call event and FIGS request category. 

If the VPLMN cannot monitor the subscriber, it shall indicate this as a response to the FIGS request. 

The HPLMN shall be able to modify the amount of information received for a subscriber from a VPLMN by re-sending 
the FIGS request with a different category. 

The FDS will process this information and may then limit the activities of the subscriber using ODB or terminate the 
subscriber activities using 1ST, or may allow the subscriber to proceed. 

When the home network no longer wishes the subscriber to be monitored by the VPLMN it requests the VPLMN to stop 
monitoring the activities of the subscriber 

Figure 1 shows the sequence of FIGS messages passed during a normal case. 



5 Service conditions 

5.1 Control of monitoring of subscriber activities 

The HPLMN can request a VPLMN to begin monitoring the activities of a subscriber at any time after the subscriber 
has registered on that VPLMN. If the VPLMN is able to monitor a subscriber as requested it shall send a confirmation 
of monitoring message to the HPLMN. 

The HPLMN does not need to know the status of the target subscriber before initiation or subsequent termination of 
fraud information gathering 

Fraud information cannot be switched on or off by the subscriber or other (unauthorised) party. 

Subscribers upon which fraud information gathering has been set shall not be able by interrogating the network to 
determine that they are subject to fraud information gathering. 

Subscribers upon which fraud information gathering has been set shall not be able, for example by changes to normal 
call set up times, speech quality or general transmission characteristics, to determine that they are subject to fraud 
information gathering. 

If the VPLMN receives a request to monitor the activities of a subscriber and an activity to be monitored is already 
ongoing the VPLMN shall send information on this activity to the HPLMN. 

If the VPLMN receives a request to cease monitoring the activities of a subscriber and an activity is already ongoing and 
being monitored, the VPLMN shall immediately cease sending information on this activity to the HPLMN. 

5.2 Number of calls monitored by a VPLMN 

If the VPLMN has to monitor the activities of a large number of subscribers for FIGS this may degrade the performance 
of the VPLMN. Each VPLMN (in reality, each network entity involved in FIGS monitoring) will therefore have a 
maximum number of subscribers that it can monitor. 

If the number of monitored subscribers has reached this upper limit the VPLMN shall reject requests for monitoring of 
subscribers from HPLMNs until the number of monitored subscribers decreases below the limit. 

Each VPLMN may have a limit per HPLMN on the number of subscribers from that HPLMN that it will monitor. When 
an HPLMN has requested a VPLMN to monitor a number of subscribers equal to the limit for that HPLMN, the 
VPLMN can refuse any subsequent requests for FIGS monitoring from that PLMN, until the number of monitored 
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subscribers drops below the limit. The principles behind the setting of these limits are outside the scope of this 
specification. 

In order to minimise the number of subscribers that a VPLMN has to monitor, the HPLMN should limit itself to 
requesting information about subscriber's monitored activities in: 

- the current VPLMN; 

the last previously served VPLMN. 

5.3 Interworking with non-supporting networks 

If the HPLMN does not receive a positive acknowledgement to the request for FIGS monitoring sent to a VPLMN, it 
shall assume that the VPLMN does not support FIGS. The HPLMN may then act as appropriate (e.g. put appropriate 
ODB categories in place). 



5.4 Information Delivery Time 



The need for up to date information is a critical part of any fraud information system. The sooner data is transferred to 
the HPLMN, the sooner fraud can be stopped. Therefore the proscribed information shall be transferred from the 
VPLMN network to the HPLMN within two minutes of the occurrence of a FIGS -monitored event. 

The information should be transferred from the VPLMN to the HPLMN over appropriate communication links. 



6 Monitored activity 

The authorised party can request the VPLMN to monitor both call activity and supplementary services. 

The monitoring of call activity shall take the form of transmission of call information from the VPLMN to the HPLMN, 
at the start and end of all calls. For long calls, the VPLMN shall also send partial call information a certain time (e.g. 15 
minutes) after the call has begun. 

Call information shall be sent to the HPLMN by the VPLMN on the invocation of all supplementary services, e.g.: 

call deflection; 

call forwarding; 

call hold; 

- MPTY; 

- ECT. 

The HPLMN can decide to prevent future invocation of the same or all supplementary services using ODB. The 
decision mechanism is out of the scope of this specification. 



Y- 1 interface 



The Y-Interface is used to transfer information gathered by the HPLMN to Non-GSM systems. These will decide if the 
monitored activity is fraudulent and will advise the home network to take appropriate action, e.g. send an 1ST command 
to the VPLMN, change the subscriber's ODB categories. 

The contents of call information messages to be transferred on this interface shall be specified but not the transfer 
mechanism. This is in line with the approach used for the X-interface as specified in GSM 02.33. The message formats 
are defined in annex A. 

The system needs the ability to handle the volume of information returned to the home network. 
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8 J/K interfaces 



The interface between the HPLMN and the VPLMN that is used to send FIGS data from the VPLMN to the HPLMN 
shall be called the J-interface. The contents of messages to be sent on this interface shall be specified but not the transfer 
mechanism. 

The interface between the HPLMN and the VPLMN that is used to send FIGS commands from the HPLMN to the 
VPLMN shall be called the K-interface. The contents of messages to be sent on this interface shall be specified but not 
the transfer mechanism. 



9 Security Requirements between HPLIVIN and VPLIVIN 

It is expected that there will be a need for authentication, data integrity and confidentiality of the communication made 
between PLMNs. 

These issues are for study under other work items within the SMG 10 work programme. 
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Annex A (normative): 

Information transferred by the VPLIVIN 

The reports generated by the VPLMN shall take the form of "call information" records for each monitored subscriber. 
The content of the call information will depend on the type of event (call start, end etc.) and the amount of information 
requested by the HPLMN (minimum, standard or detailed). To simplify matters, there will be one format for both MO 
and MT calls with an MO/MT indicator within the call information to distinguish between the two. 

A partial call information will be sent to the HPLMN when there is an mid-call invocation of a supplementary service 
and when a call in progress has exceeded a defined duration. If the mid-call supplementary service begins another call 
(e.g. when ECT is invoked) both a call start and a partial call information shall be sent. 

If FIGS monitoring is begun by a VPLMN on a subscriber when that subscriber already has a call in progress, a partial 
call information shall be sent for that call as soon as possible after the request for the FIGS monitoring is received by the 
VPLMN. In such a case, the partial call information should contain those fields indicated as required by both the call 
start information and the partial call information. 

For each type of call information, justification is given for the content of the minimum call information message. 

Table A.1 : Call start 



Information 


Minimum 


Standard 


Detailed 


Dialled digits 


•/ 


-/ 


•/ 


A party number 




■/ 


-/ 


B party number 






•/ 


C party number 






-/ 


CGI 






•/ 


IMSI 


■/ 


■/ 


-/ 


IMEI 




-/ 


•/ 


Call Start Time/Date 


-/ 


-/ 


-/ 


Call Reference 


•/ 


-/ 


•/ 


MO/MT indicator 


-/ 


■/ 


-/ 


Visited MSC address 


-/ 


-/ 


•/ 


Type of SS event 


(^) 


■/ 


-/ 


Type of service 


(^) 


•/ 


•/ 



The dialled digits are required as these are an important indicator in deciding if a call is fraudulent or not - certain call 
destinations are more likely to be called fraudulently than others. 

The IMSI is used to reference the subscriber. 

The call start time is required so that the call duration can be calculated (if the call end time and not call duration is 
given at call conclusion) and because the call start time can also an important indicator of fraudulency. 

The call reference is used to reference a particular call. 

The MO/MT indicator is required because call charging is different for MO and MT calls. 

The visited MSC address gives the PLMN on which the call was made. 
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The Type of SS event record is sent if the "call" start is actually the invocation of a supplementary service, e.g. change 
of call forwarding number. The Type of SS event is required as this can help to indicate if the mobile is being 
fraudulently used or not. 

The Type of Service indicates whether a tele- or bearer service is being used and which sort of tele- or bearer service is 
being used and is sent if the event is a call and not a supplementary service. The Type of Service is required as this can 
help to indicate if the mobile is being fraudulently used or not. 

Table A.2: Partial call information 



Information 


Minimum 


Standard 


Detailed 


Dialled digits 






^ 


A party number 




,/ 


•/ 


B party number 




^ 


-/ 


C party number 






•/ 


CGI 






-/ 


IMSI 


•/ 


-/ 


•/ 


IMEI 






-/ 


Call Start Time/Date 




-/ 


-/ 


Call Duration 


-/ 


^ 


-/ 


Call Reference 


•/ 


-/ 


•/ 


MO/MT indicator 




■/ 


-/ 


Type of SS Event 


•/ 


-/ 


-/ 


Type of service 


-/ 


• 


-/ 


Visited MSC address 




(^) 


(^) 



The IMSI is used to reference the subscriber. 



The call duration gives the duration of the call at the sending of the partial call information - call duration can be an 
important indicator of fraudulency. 

The type of SS event is required (if the partial call information is caused by the invocation of a supplementary service) 
because some types of supplementary service are more susceptible to fraud than others. 

The call reference is used to reference the call and to link the partial call information to the call start information. 

The Type of SS event record is sent if the "call" start is actually the invocation of a supplementary service, e.g. change 
of call forwarding number. The Type of SS event is required as this can help to indicate if the mobile is being 
fraudulently used or not. 

The Type of Service indicates whether a tele- or bearer service is being used and which sort of tele- or bearer service is 
being used and is sent if the event is a call. The Type of Service is required as this can help to indicate if the mobile is 
being fraudulently used or not. 
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Table A.3: Call End 



Information 


Minimum 


Standard 


Detailed 


A party number 


•/ 


^ 


•/ 


B party number 


-/ 


■/ 


-/ 


CGI 






•/ 


IMSI 


-/ 


• 


-/ 


IMEI 






•/ 


Call Duration (note) 


-/ 


^ 


-/ 


Call Reference 


-/ 


-/ 


•/ 


MO/MT indicator 






-/ 


Type of SS Event 




-/ 


•/ 


NOTE: The call duration or call end time may be sent. 



The A-number gives the MSISDN of the subscriber, which is not sent on call start or partial information messages. 

The B-number gives the eventual destination number of the call, which may be different from the dialled digits. Like 
dialled digits it is an important indicator of call fraudulency. 

The IMSI is used to reference the subscriber. 

The call duration can be an important indicator of fraudulency. 

The call reference is used to link the call end information to the call start and partial call information messages. 

The Type of SS event record is sent if the "call" start is actually the invocation of a supplementary service, e.g. change 
of call forwarding number. The Type of SS event is required as this can help to indicate if the mobile is being 
fraudulently used or not. 

The Type of Service indicates whether a tele- or bearer service is being used and which sort of tele- or bearer service is 
being used and is sent if the event is a call. The Type of Service is required as this can help to indicate if the mobile is 
being fraudulently used or not. 
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Annex B (normative): 

Message flow in FIGS monitoring, normal procedure 



LMN 


J/K interface 
Request for FIGS monitoring 


VPLMN 


^ 


Positive Acknowledgement 


W 




FIGS Data 






FIGS Data 




^ 


Request to stop FIGS monitoring 


^ 






W 
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